Holdover begins when the timing unit can no longer discipline its local oscillator from an accepted GNSS reference. A usable requirement names the pre-outage lock and warm-up state, outage duration, temperature and supply profile, oscillator type and history, allowed frequency behavior and maximum accumulated time or phase error at the delivered output.
Do not reduce holdover to the oscillator data-sheet accuracy. The steering loop estimates and corrects oscillator behavior while GNSS is available; environmental change, aging, prior learning interval and the algorithm used after reference loss all influence the result. State the stability statistic and averaging interval for frequency outputs and the time-error mask for timing outputs.
Also define loss detection, alarm latency, output-valid flag, behavior during degraded or intermittent reception, reacquisition and any permitted phase correction after recovery. Test from controlled initial states at relevant temperatures and retain the complete time-error record; a single end-point value can hide steps or excursions that downstream equipment cannot accept.